1. INTRODUCTION 1.1 QuiaPEG Pharmaceuticals AB, (hereinafter "QuiaPEG") is personally responsible and processes personal data relating to physical persons communicating and sharing personal information with QuiaPEG via digital channels (eg website and email). 1.2 QuiaPEG shall handle personal information correctly and in accordance with applicable laws and rules for data protection. QuiaPEG is open with why and in what manner the personal data will be processed. 2. PERSONAL DATA TO BE STORED 2.1 Personal data that may be processed and stored when the user communicates with QuiaPEG via website or email include, for example: • name • Mail and Email Address • IP address • phone number • organizational information • contact information of various kinds 3. WHAT PERSONAL DATA IS USED FOR The following explains the purpose of processing personal data. 3.1 QuiaPEG processes personal information in order to communicate or track interest from customers or stakeholders who actively chose to contact the company. The data will not be shared to third parties or used for other purposes that the customer has not clearly chosen and accepted to take part of (eg direct marketing). 3.2 Based on customer agreement The communication between the website visitor and QuiaPEG contains a consent clause whereby the Registrar may voluntarily consent to QuiaPEG processing the Registered Personal Data for the purposes stated above. This consent may be revoked by the Registrar. 4. SECURITY 4.1 QuiaPEG will ensure that appropriate technical and organizational security measures are taken to protect personal data against abuse, destruction and loss through accident or unauthorized disclosure. If QuiaPEG employs a third party to provide QuiaPEG with services that include the processing of personal data, QuiaPEG will ensure that such partners apply appropriate security measures and treat only personal data as QuiaPEG has approved. 4.2 When transferring information via the internet, security can never be guaranteed. Although QuiaPEG implements security measures for the protection of personal data (such as encryption), QuiaPEG can not guarantee absolute security for information that the Registrar transfers to the QuiaPEG website. All data transfer is therefore carried out on the Registrar's own risk. Once QuiaPEG has received information, QuiaPEG will apply strict procedures and security measures to prevent unauthorized access. 5. COLLECTION OF PERSONAL DATA BY COOKIES (COOKIES) 5.1 QuiaPEG uses cookies on its website to (i) provide functionality, (ii) analyze how services are used and to give users the best user experience. 5.2 A cookie is a text file that the browser saves in the visitor's computer. The text file contains information used for example to facilitate the visitor's use of the website and save settings for subsequent visits. There are two main types of cookies: 1) A permanent cookie that is left on the visitor's computer for a specified time 2) A session cookie stored temporarily in the computer's memory while a visitor is on a web page. Session cookies disappear when the user closes the browser. 5.3 Permanent cookies are used to store, for instance, personal settings of the user, as well as to customize information and marketing. Session cookies are used to register statistics about the use of the website. 5.4 If users do not want to accept cookies, they can be blocked in browser settings. Note that if cookies are not disabled, QuiaPEG will assume that the user accepts cookies. 6. THE USER RIGHTS 6.1 Right of registration, correction and opposition 6.1.1 The Registrar is entitled to request registry exemption free of charge for the personal data processing performed by QuiaPEG. The Registrar also has the right to request correction of incorrect data as well as opposition to processing of personal data treated with legitimate interests to Article 6 (1) (f) Data Protection Regulation. 6.1.2 In the User's opposition to processing of personal data for direct marketing, QuiaPEG will discontinue such treatment. 6.2 Disposal and right of deletion 6.2.1 The Registrar's data will not be retained for longer than is necessary for the purpose of the processing and QuiaPEG will otherwise disidentify personal data in accordance with applicable law. 6.2.2 The Registrar also has the right to require deletion of incorrect data and when processing of personal data is no longer necessary. The request for deletion can also be made for personal data processed for direct marketing. 6.3 Right to limitation of personal data processing 6.3.1 The Registrar is entitled to request a limitation of personal data processing in the following cases. a. If the Registrar questions the accuracy of personal data. b. If the personal data processing is unauthorized and the Registrar chooses a limitation of personal data instead of deletion. c. If the personal data is no longer required for the purposes previously dealt with, and then the Registrar needs these in order to determine, enforce or defend legal claims. d. If the Registrar opposes treatment that relies on a balance of interest. 6.3.2 A limitation of personal data processing means that personal data will continue to be stored but not further processed by QuiaPEG without the consent of the Registrar. 6.4 Right to data portability 6.4.1 The Registrar has the right to request personal data in a structured, widely used and machine-readable format for the information that the Registrar himself has provided. 6.5 Exercise of rights 6.5.1 If the Registrar wishes to avail himself of one or more of his rights as described above, the Registrar may direct such request to QuiaPEG. Contact details can be found below. 6.5.2 QuiaPEG will promptly process a request from the Registrar. If QuiaPEG does not intend to grant a request in whole or in part, the Registrar will be informed accordingly and the reasons for the decision. 7. COMPETENT AUTHORITY 7.1 In the event that the Registrar is dissatisfied with QuiaPEG processing of personal data or decision regarding a request in accordance with the above, complaints may be made to Datainspektionen in Sweden or other applicable authority. Contact information to Datainspektionen can be obtained through its website, www.datainspektionen.se. 8. CONTACT For questions about this privacy policy or the processing of personal data please contact QuiaPEG's information representative: E-mail: info@quiapeg.com Phone: +46 (0) 70 693 12 53 Address: Virdings Allé 32 B 754 54 Uppsala Sverige